CVE-2021-3995: Medium severity util-linux vulnerability
A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this logic error in the libmount library of util-linux?
The vulnerability ID for this logic error is CVE-2021-3995.
What is the severity of CVE-2021-3995?
The severity of CVE-2021-3995 is medium with a CVSS score of 5.5.
How does this vulnerability in the libmount library of util-linux impact affected systems?
This vulnerability allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users with a UID prefix match.
Which software versions are affected by CVE-2021-3995?
Versions of util-linux up to and including 2.37.3 and Fedora 35 are affected by CVE-2021-3995.
Are there any references for CVE-2021-3995?
Yes, here are some references for CVE-2021-3995: [link1](http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html), [link2](http://seclists.org/fulldisclosure/2022/Dec/4), [link3](http://www.openwall.com/lists/oss-security/2022/11/30/2).